Hacker News new | past | comments | ask | show | jobs | submit login

One clarification: You choose the signing keys you trust.

You can also partially trust keys, in which case a given key requires multiple signatures (from partially-trusted signers) to itself be considered trusted.

Note the distinction between trusting a key and its signers.

Among core problems with PGP/GPG is the lack of a notion of a negative trust signature. That is "I am signing this key to indicate that I know it is not what it claims to be and/or is otherwise not trustworthy". That would be generally useful (and, of course, also generally exploitable in various ways, a common story).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: